DynELF outputs a bad warning

[TethysSvensson]

DynELF will sometimes output the warning No ELF provided. Leaking is much faster if you have a copy of the ELF being leaked., even though an ELF was provided. It seems to be because it calls itself recursively.

from pwn import *

r = process('./foo')
ptr = safeeval.const(r.readline().strip()) - 0x201038

def leak(addr):
    size = (addr | 0xfff) + 1 - addr
    r.send(p64(addr) + p64(size))
    data = r.recvn(size)
    return data

dynelf = DynELF(leak, pointer = ptr, elf = ELF('./foo'))
dynelf.lookup('system', 'libc')

// Compile with: gcc -fpie foo.c -o foo
#include <stdio.h>
#include <stdint.h>

uintptr_t ptr;
size_t size;

int main() {
  printf("%p\n", (void*) &ptr);

  while(1) {
    if (fread(&ptr,  sizeof(ptr),  1, stdin) != 1) break;
    if (fread(&size, sizeof(size), 1, stdin) != 1) break;
    if (fwrite((void*) ptr, size, 1, stdout) != 1) break;
    fflush(stdout);
  }
}

[+] Starting local process './foo': pid 12989
[*] '/tmp/wut/foo'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled
    FORTIFY:  Enabled
[+] Loading from '/tmp/wut/foo': 0x7fccd4f0c168
[+] Resolving 'system' in 'libc.so': 0x7fccd4f0c168
[!] No ELF provided.  Leaking is much faster if you have a copy of the ELF being leaked.
[*] Trying lookup based on Build ID: d1cefae0e95588b90000be5c2d0ee8d18db5dbfe
[*] Using cached data from '/home/idolf/.pwntools-cache/libcdb/build_id/d1cefae0e95588b90000be5c2d0ee8d18db5dbfe'
[*] Stopped process './foo' (pid 12989)

[zachriggle]

Yeah, I remember seeing this a while ago. Thanks for filing a bug! I don't look forward to fixing this one :(

[Arusekk]

This seems to be a warning that the libc ELF is not provided/found on libcdb, not the ELF of the binary itself. Not sure, though.

[heapcrash]

I think @TethysSvensson's issue was that even if a libc ELF() is directly provided, it still complains about it not being provided.

dynelf = DynELF(leak, pointer = ptr, elf = ELF('./foo'))
dynelf.lookup('system', 'libc')

[!] No ELF provided.  Leaking is much faster if you have a copy of the ELF being leaked.

[Arusekk]

This is only about libc. Works just as expected: libc is never given explicitly. (Local libc should now be tried first since #2325 anyway.)